Log on to CloudSSO by using Alibaba Cloud CLI

Step 1: Install CLIs

You must install Alibaba Cloud CLI and CloudSSO CLI:

• Install Alibaba Cloud CLI

  • Windows

  • Linux

  • macOS

• Install CloudSSO CLI

  1. Install Node.js.

     Install the package management tool npm when you install Node.js.

     Note

     You must install Node.js 7.6.0 or later. Install the latest LTS version for best compatibility.

  2. Run the following command to install the CloudSSO CLI:

     npm i @alicloud/sso-cli -g

  CloudSSO CLI.

Step 2: Configure CloudSSO access

1. Run the following command to configure CloudSSO access:

   acs-sso configure

2. Enter signinUrl, which indicates the URL that is used to log on to the CloudSSO user portal.

   Note

   To obtain the signinUrl, log on to the CloudSSO console, go to the Overview page, and then find the User Logon URL section on the right.

   Sample request:

   acs-sso configure
   ? please input 'signinUrl': https://signin-******.alibabacloudsso.com/device/login

   Sample success response:

   configuration done!

Step 3: Log on to Alibaba Cloud as a CloudSSO user

Commonly used commands:

• Default logon

  1. Run the following command:

     acs-sso login

  2. A browser window opens. Log on to the user portal, then close the browser.

     If the browser does not open, copy the logon URL and user code from the CLI output to complete the process.

     Example:

     If your default browser is not opened automatically, please use the following URL to finish the signin process.
     Signin URL: https://signin-****.alibabacloudsso.com/device/code
     User Code: *********

  3. If you have access to multiple Resource Directory accounts, the CLI prompts you to select an account and access configuration, then generates the AccessKey pair.

     Example:

     You have logged in.
     used account: test-account(191585963325****)
     used access configuration: TestAC(ac-x08xz11covd3cyzd****)
     {
       "mode": "StsToken",
       "access_key_id": "STS.****",
       "access_key_secret": "****",
       "sts_token": "****"
     }

  After logon, the selected account and access configuration are cached in the profile and reused for subsequent logons.

• Logon by using logon profiles

  acs-sso login --profile sso

  Use the --profile option to distinguish between multiple Resource Directory accounts and access configurations. The preceding command uses the profile named sso.

  If you omit --profile, the profile named default is used.

• Obtain logon configurations.

  acs-sso profile --list

• Delete a specific logon configuration.

  Run the following command to delete the default logon configuration:

  acs-sso profile --delete --profile default

  Run the following command to delete the logon configuration named sso:

  acs-sso profile --delete --profile sso

• Configure the mode of the output.

  Configure one of the following output modes:

  • External process mode (default): Uses --mode External in Alibaba Cloud CLI. Use an external program to get credentials.

    Example:

    {
      "mode": "StsToken",
      "access_key_id": "STS.NUyPeEoab****",
      "access_key_secret": "GBubpmh****",
      "sts_token": "CAIS****"
    }

  • Environment variable mode: You can use this mode by configuring the --env parameter. Example: acs-sso login --profile user1 --env.

    Example:

    export ALIBABACLOUD_ACCESS_KEY_ID=STS.NUyPeEoab****
    export ALIBABACLOUD_ACCESS_KEY_SECRET=GBubpmh****
    export SECURITY_TOKEN=CAIS****

    Environment variables can be used together with Alibaba Cloud tools such as Terraform. Example: `acs-sso login --profile user1 --env` && terraform plan.

    Environment variables can be used together with Alibaba Cloud CLI. Example: `acs-sso login --profile user1 --env` && aliyun ecs DescribeRegions.

Step 4: Access Alibaba Cloud resources

Example:

aliyun configure --mode External --profile sso
Configuring profile 'sso' in 'External' authenticate mode...
Process Command []: acs-sso login --profile sso
Default Region Id []: cn-shanghai
Default Output Format [json]: json (Only support json)
Default Language [zh|en] en: 
Saving profile[sso] ...Done.

The Process Command value acs-sso login --profile sso specifies the logon profile as sso. Use the same profile name for both Alibaba Cloud CLI and CloudSSO CLI to keep credentials aligned.

Sample success response:

Configure Done!!!
..............888888888888888888888 ........=8888888888888888888D=..............
...........88888888888888888888888 ..........D8888888888888888888888I...........
.........,8888888888888ZI: ...........................=Z88D8888888888D..........
.........+88888888 ..........................................88888888D..........
.........+88888888 .......Welcome to use Alibaba Cloud.......O8888888D..........
.........+88888888 ............. ************* ..............O8888888D..........
.........+88888888 .... Command Line Interface(Reloaded) ....O8888888D..........
.........+88888888...........................................88888888D..........
..........D888888888888DO+. ..........................?ND888888888888D..........
...........O8888888888888888888888...........D8888888888888888888888=...........
............ .:D8888888888888888888.........78888888888888888888O ..............

Verify Alibaba Cloud CLI access:

aliyun sts GetCallerIdentity --profile sso